CVE-2023-43642
📋 TL;DR
The snappy-java library is vulnerable to denial of service attacks when processing compressed data with maliciously large chunk sizes. This affects all Java applications using snappy-java for compression/decompression. Attackers can cause unrecoverable fatal errors by sending specially crafted compressed data.
💻 Affected Systems
- snappy-java
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption causing application crashes and unavailability
Likely Case
Service degradation or crashes when processing untrusted compressed data
If Mitigated
Minimal impact if only trusted data sources are used
🎯 Exploit Status
Exploitation requires sending malicious compressed data to vulnerable endpoints
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.10.4
Vendor Advisory: https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv
Restart Required: Yes
Instructions:
1. Update pom.xml or build.gradle to use snappy-java version 1.1.10.4 or higher
2. Run dependency update command (mvn clean install or gradle build)
3. Restart affected Java applications
🔧 Temporary Workarounds
Input validation and filtering
allImplement input validation to reject compressed data from untrusted sources
🧯 If You Can't Patch
- Implement strict input validation to only accept compressed data from trusted sources
- Deploy network filtering to block suspicious compressed data patterns
🔍 How to Verify
Check if Vulnerable:
Check dependency manifest for snappy-java version <= 1.1.10.3Check Version:
mvn dependency:tree | grep snappy-java OR gradle dependencies | grep snappy-javaVerify Fix Applied:
Verify snappy-java version is >= 1.1.10.4 in dependency manifest📡 Detection & Monitoring
Log Indicators:
- Java application crashes with OutOfMemoryError or similar exceptions
- Unusual decompression failures in application logs
Network Indicators:
- Large compressed payloads sent to decompression endpoints
- Sudden spikes in decompression-related traffic
SIEM Query:
source="application.logs" AND ("OutOfMemoryError" OR "SnappyInputStream" OR "decompression failed")🔗 References
- https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
- https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv
- https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
- https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv
